Quick answers
- Is CVE-2026-30798 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-30798 being exploited in the wild.
- How severe is CVE-2026-30798?
- High severity, with a CVSS score of 7.5, published 5 March 2026.
- Which products and versions are affected?
- RustDesk Client through 1.4.8.
- Is there a fix for CVE-2026-30798?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-30798 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-30798?
- Check whether you run Apple Iphone Os, Apple macOS, Google Android or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in the RustDesk Client's heartbeat synchronization loop and strategy processing modules (specifically src/hbbs_http/sync.rs). The client fails to sufficiently verify the authenticity of 'strategy' payloads received from the API server. An attacker who successfully performs a Man-in-the-Middle (MitM) attack or redirects a client to a rogue API server can inject a 'stop-service' instruction. Because the client merges these unauthenticated strategy options with higher priority than local user settings, it will execute the 'stop-service' handler, leading to a remote denial-of-service. This affects clients on Windows, MacOS, Linux, iOS, and Android.
Affected products
- RustDesk RustDesk Client through 1.4.8
Timeline
- 2026-03-05: disclosed: Initial vulnerability discovery and documentation by VULSec Labs
- 2026-06-22: advisory: Updated advisory confirming the vulnerability persists in version 1.4.8